What is an offline cloud file?¶
An offline cloud file is a cloud-managed file that has been downloaded to a device so it can be used without an internet connection.
The file remains linked to the cloud service, but a local copy is available.
What this means in practice¶
When the device reconnects, edits, deletions or other changes may synchronise back to the provider. Changes made elsewhere may also update the local copy.
An offline file may therefore have both local and cloud histories.
The two versions may temporarily differ. If the device remained offline, the local copy may be older or newer than the cloud version.
Conflicts can occur when the same file is edited in several places. The service may create a separate conflict copy or choose one version according to its own rules.
For investigators, identify whether the file was marked for offline access, when the local copy was created and when the device last synchronised.
What this may show¶
The local device may show when the copy was downloaded, opened or modified. The cloud service may show when it was marked for offline use, synchronised or updated.
Equally, later local activity may show that the user interacted with it while disconnected.
What this does not show on its own¶
The dangerous assumption is that “offline” means the file is no longer connected to the cloud.
What to do next¶
Do not assume that the presence of an offline copy proves the user opened or read it. The application may have downloaded it automatically based on folder settings.
Key takeaway
An offline cloud file is a local working copy tied to the cloud service, so compare the local activity with the last and next synchronisation events.